Package com.pd4ml.pdf.sign

Class CertificateUtils.SigningIdentity

  • Enclosing class:
    CertificateUtils
    public static final class CertificateUtils.SigningIdentity
extends java.lang.Object
    Holds the certificate chain to sign with, plus however this identity's private key operations actually get performed: an in-process PrivateKey (PKCS#12; getProvider() is null, any JCA provider -- normally BouncyCastle -- may perform the RSA/EC operation), an opaque PrivateKey handle tied to one specific Provider (PKCS#11; that exact provider instance must perform the operation, since the key material never leaves the token), or no local key at all, only a RemoteSigner (cloud KMS).

    • Method Summary

      All Methods Instance Methods Concrete Methods 
      Modifier and Type Method Description
      java.security.cert.Certificate[] getCertificateChain()
      A defensive copy of the certificate chain -- mutating the returned array never affects this identity.
      java.security.PrivateKey getPrivateKey()
      The local private key handle, or null for a getRemoteSigner()-backed (KMS) identity.
      java.security.Provider getProvider()
      The JCA Provider that MUST perform any Signature operation with getPrivateKey() (set for a PKCS#11-backed identity, whose key is non-extractable and only usable through the exact provider instance that opened the token session), or null if the key has no such constraint (PKCS#12).
      RemoteSigner getRemoteSigner()
      The remote signing callback for a KMS-backed identity, or null for a local (PKCS#12/PKCS#11) key.
      java.security.cert.X509Certificate getSigningCertificate()  

      • Methods inherited from class java.lang.Object

        equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    • Method Detail

      • getPrivateKey

        public java.security.PrivateKey getPrivateKey()
        The local private key handle, or null for a getRemoteSigner()-backed (KMS) identity.

      • getCertificateChain

        public java.security.cert.Certificate[] getCertificateChain()
        A defensive copy of the certificate chain -- mutating the returned array never affects this identity.

      • getSigningCertificate

        public java.security.cert.X509Certificate getSigningCertificate()

      • getProvider

        public java.security.Provider getProvider()
        The JCA Provider that MUST perform any Signature operation with getPrivateKey() (set for a PKCS#11-backed identity, whose key is non-extractable and only usable through the exact provider instance that opened the token session), or null if the key has no such constraint (PKCS#12).

      • getRemoteSigner

        public RemoteSigner getRemoteSigner()
        The remote signing callback for a KMS-backed identity, or null for a local (PKCS#12/PKCS#11) key.